Solaris

Lucky you had the possibility to have the unix schema added to AD !

I had to install Sun Directory services and it windows synchronization tools to have a single sign-on in the company ...

Tony,the AD i am using is a test AD(in a lab). currently i have only two machines connected to it,a windows desktop and the other a Sol10 client. i haven't created any OU's.
I have ensured that i am able to login using the bind user from the windows desktop.
So,I believe it's not a password incorrect issue.

Anyway,I will keep searching. Do let me know if you come across something worthwhile. Hoping that ur doc's do give me some. Thanks for ur consistent and informative replies.

Thanks
HG

Hi Lauren,
Could u elaborate on how you did that?
Is Sun directory services a paid software?
Any doc's for reference?

It's the end that matters not the means.

HG

I've installed Sun Directory services 6.3 from there (for free)

Sun Java System Directory Server Enterprise Edition

I see there is now a 6.3.1
I had to install from the compress archive (zip) as the identity synchronization for windows was not part of the full pkg...

Lauren

Currently i have a Solaris only environment.
So Would you advise me to use Sun Directory services for Integarating with AD or wud it be better to use Scott's methodology?

HG

of course and as usual, it depend ...
I'm in an heterogenous environment, windows, solaris linux.
Adding unix schema to the corporate AD sounded to risky for management ...
There was a first attempt of synchronization done using openlad and kerberos but logs where full of error messages.

The main advantage of using a sun directory services is that you just need a unixproxy account from the AD administrators, after that your on the road.
you can manage nfs automount as well, works with redhat clients too...

I'm actually working on a per user/server access restriction so that Dev guy's can't log onto QA servers until they are granted from the ldap server...

I'll have to look if in the 6.3.1 pkg version they have included the identity sync tool !

Hi Tony,
Despite trying a few changes, I am still where I was.
Still facing the Invalid Credentials issue.
ldaplist showing object not found error.

I too feel that it is an issue with bind and I am not sure whether the highlighted entry is right.
Can you help me to modify it.
# cat ldapclient-mssfu.sh
ldapclient -v manual \
-a credentialLevel=proxy \
-a authenticationMethod=simple \
-a proxyDN=cn=fis,cn=Users,dc=lxdc-india,dc=com \
-a proxyPassword=efunds_15 \
-a defaultSearchBase=dc=lxdc-india,dc=com \
-a domainName=lxdc-india.com \
-a "defaultServerList=10.0.0.3" \
-a attributeMap=group:userpassword=msSFU30Password \
-a attributeMap=group:memberuid=msSFU30MemberUid \
-a attributeMap=group:gidnumber=msSFU30GidNumber \
-a attributeMap=passwd:gecos=msSFU30Gecos \
-a attributeMap=passwd:gidnumber=msSFU30GidNumber \
-a attributeMap=passwd:uidnumber=msSFU30UidNumber \
-a attributeMap=passwd:uid=msSFU30Name \
-a attributeMap=passwd:homedirectory=msSFU30HomeDirectory \
-a attributeMap=passwd:loginshell=msSFU30LoginShell \
-a attributeMap=shadow:shadowflag=msSFU30ShadowFlag \
-a attributeMap=shadow:userpassword=msSFU30Password \
-a objectClassMap=grouposixGroup=group \
-a objectClassMap=passwdosixAccount=user \
-a objectClassMap=shadow:shadowAccount=user \
-a serviceSearchDescriptor=passwd:dc=lxdc-india,dc=com?sub \
-a serviceSearchDescriptor=group:dc=lxdc-india,dc=com?sub

In ADSI EDIT, I see this entry:
CN=User CN=User,CN=schema,CN=configuration,DC=lxdc-india,DC=com

So should I change the proxyDN entry to:
-a proxyDN=cn=fis,cn=User,cn=schema,cn=configuration,dc=lxdc-india,dc=com \
If an entry for ou is required,how and where should I add it

Also,please let me know whether the attribute mappings are fine. If it has to be checked somewhere in ADSI edit,please let me know where to check it.

I am trying hard to understand LDAP and ur inputs will be a big helping hand.


Thanks-in-advance
HG